Incident: Failure of Hands-Off Detection in Lincoln Nautilus ADAS System

Published Date: 2019-01-16

Postmortem Analysis
Timeline 1. The software failure incident related to the 2019 Lincoln Nautilus SUV's advanced driver assist systems occurred between September 5 and November 19, 2018 as per the article [80646]. 2. The article was published on January 16, 2019. 3. Therefore, the software failure incident happened between September and November 2018.
System 1. Advanced driver assist systems software in the 2019 Lincoln Nautilus SUV [80646].
Responsible Organization 1. Ford Motor Company [80646]
Impacted Organization 1. Drivers of the 2019 Lincoln Nautilus SUV affected by the software failure incident [80646].
Software Causes 1. The software cause of the failure incident was related to the vehicle's advanced driver assist systems not detecting if a driver has their hands off the steering wheel while the lane-centering system is activated, leading to a potential risk of a crash [80646].
Non-software Causes 1. The failure incident was caused by the vehicle's advanced driver assist systems not detecting if a driver has their hands off the steering wheel while the lane-centering system is activated, leading to a potential crash risk [80646].
Impacts 1. The software failure incident in the 2019 Lincoln Nautilus SUV could lead to the vehicle not detecting if the driver has their hands off the steering wheel while the lane-centering system is activated, potentially increasing the risk of a crash [80646].
Preventions 1. Implementing thorough testing procedures during the software development phase to detect issues related to the advanced driver assist systems could have prevented the software failure incident [80646]. 2. Conducting comprehensive validation and verification processes specifically focused on the functionality of the lane-centering system and hands-off detection could have identified the issue before the vehicles were released to the market [80646]. 3. Regularly monitoring and analyzing feedback from users or conducting real-world testing to identify any potential software-related issues that may impact safety features could have helped prevent the incident [80646].
Fixes 1. Technicians will reflash the software in the power steering control module to provide the correct level of hands-off detection when the ADAS is in use [80646].
References 1. Ford Motor Company [80646]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The article does not mention any previous incidents of a similar software failure within Ford Motor Company or with its products and services. Therefore, there is no information available to suggest that this specific software failure incident has happened again at the same organization. (b) The article does not provide information about similar incidents happening at other organizations or with their products and services. Hence, there is no data available to indicate that this specific software failure incident has occurred elsewhere.
Phase (Design/Operation) design (a) The software failure incident in the article is related to the design phase. The issue stems from software related to the vehicle's advanced driver assist systems, specifically in detecting if a driver has their hands off the steering wheel while the lane-centering system is activated. This indicates a failure due to contributing factors introduced during the system development or updates, as the software did not function as intended in detecting the driver's hands-off behavior, leading to a potential crash risk ([80646]). (b) There is no information in the article suggesting that the software failure incident was related to the operation phase or misuse of the system.
Boundary (Internal/External) within_system (a) The software failure incident related to the Lincoln Nautilus SUV's advanced driver assist systems not detecting if a driver has their hands off the steering wheel while the lane-centering system is activated is within the system. The issue originates from the software related to the vehicle's advanced driver assist systems, specifically the power steering control module, which requires reflash to provide the correct hands-off detection when the ADAS is in use [80646].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the article is related to non-human actions. The problem stems from software related to the vehicle's advanced driver assist systems, specifically in detecting if a driver has their hands off the steering wheel while the lane-centering system is activated. This issue could increase the risk of a crash, but Ford is unaware of any accidents or injuries resulting from it. The fix for this issue involves reprogramming the software in the power steering control module, indicating that the failure was due to factors introduced without human participation [80646].
Dimension (Hardware/Software) hardware, software (a) The software failure incident mentioned in Article 80646 is related to hardware. The recall issued by Ford for the 2019 Lincoln Nautilus SUV was due to a problem with the software related to the vehicle's advanced driver assist systems. The issue was that the vehicle may not detect if a driver has their hands off the steering wheel while the lane-centering system is activated, which is a hardware-related problem as it involves the interaction between the software and the physical steering wheel. The fix for this issue did not require any replacement hardware but involved reprogramming the software in the power steering control module [80646].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in Article 80646 is non-malicious. The issue with the software related to the vehicle's advanced driver assist systems in the Lincoln Nautilus SUV was not due to any malicious intent but rather a flaw in the system's design that could potentially lead to a crash if the driver's hands are not detected on the steering wheel while the lane-centering system is activated. Ford's response to the incident also indicates a non-malicious nature, as they are addressing the problem by reprogramming the software in the power steering control module to improve hands-off detection [80646].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident in Article 80646 was not due to poor decisions but rather a technical issue related to the vehicle's advanced driver assist systems. The problem was specifically related to the software not detecting if a driver had their hands off the steering wheel while the lane-centering system was activated, which could increase the risk of a crash. The incident seems to be more of a technical oversight or flaw rather than a result of poor decisions [80646].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the article is not attributed to development incompetence. The issue with the software related to the vehicle's advanced driver assist systems was a result of the system not detecting if a driver had their hands off the steering wheel while the lane-centering system was activated. This indicates a specific technical flaw rather than incompetence in development. (b) The software failure incident in the article is more aligned with an accidental introduction of contributing factors. The problem with the software that led to the recall was not intentional but rather an accidental oversight in the detection mechanism for the driver's hands on the steering wheel while the lane-centering system was active. This accidental flaw led to the increased risk of a crash [80646].
Duration temporary The software failure incident related to the Lincoln Nautilus recall is temporary. The issue with the advanced driver assist systems software caused the vehicle to not detect if a driver had their hands off the steering wheel while the lane-centering system was activated. This specific circumstance led to the failure, and the problem can be fixed by re-flashing the software in the power steering control module, indicating that the failure is not permanent [80646].
Behaviour omission, value, other (a) crash: The software failure incident in the article is not related to a crash where the system loses state and does not perform any of its intended functions. Instead, the issue is about the vehicle's advanced driver assist systems not detecting if a driver has their hands off the steering wheel while the lane-centering system is activated, potentially increasing the risk of a crash [80646]. (b) omission: The software failure incident can be categorized under omission as the system omits to perform its intended function of detecting if a driver has their hands off the steering wheel while the lane-centering system is activated, leading to a safety risk [80646]. (c) timing: The software failure incident is not related to timing issues where the system performs its intended functions correctly but too late or too early. The problem is more about the system's failure to detect a specific condition [80646]. (d) value: The software failure incident is related to a value issue where the system performs its intended functions incorrectly. In this case, the system fails to detect if a driver has their hands off the steering wheel while the lane-centering system is activated, which is crucial for safety [80646]. (e) byzantine: The software failure incident is not characterized by a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. The issue described in the article is more straightforward, focusing on a specific failure in the detection mechanism of the driver assist systems [80646]. (f) other: The software failure incident can be categorized as an omission combined with a value issue. The system fails to perform its intended function of detecting the driver's hands off the steering wheel, which is a critical safety feature, leading to an incorrect performance of the system [80646].

IoT System Layer

Layer Option Rationale
Perception sensor, embedded_software (a) The software failure incident in the article is related to the perception layer of the cyber physical system, specifically the sensor. The issue with the advanced driver assist systems in the Lincoln Nautilus SUV is that the vehicle may not detect if a driver has their hands off the steering wheel while the lane-centering system is activated. This failure in detecting the driver's hands off the wheel is a sensor-related error, as the system is not perceiving the correct input regarding the driver's interaction with the vehicle's steering wheel. The fix for this issue involves reprogramming the software in the power steering control module to address the sensor error [80646].
Communication connectivity_level The software failure incident reported in Article 80646 is related to the connectivity level of the cyber physical system. The issue with the software in the Lincoln Nautilus SUV is specifically related to the vehicle's advanced driver assist systems not detecting if a driver has their hands off the steering wheel while the lane-centering system is activated. This failure in communication and detection is at the network or transport layer, as it involves the system's ability to communicate warnings to the driver effectively when necessary, rather than a failure at the physical layer [80646].
Application TRUE The software failure incident described in Article 80646 is related to the application layer of the cyber physical system. The issue stemmed from software related to the vehicle's advanced driver assist systems, specifically the lane-centering system not detecting if a driver has their hands off the steering wheel. This failure falls under the definition of an application layer failure as it involves bugs in the software that lead to incorrect system behavior [80646].

Other Details

Category Option Rationale
Consequence theoretical_consequence The consequence of the software failure incident related to the Lincoln Nautilus recall mentioned in Article 80646 is as follows: (h) theoretical_consequence: The article mentions that the software issue could increase the risk of a crash if the driver does not receive warnings to return their hands to the wheel while the lane-centering system is activated. However, Ford is unaware of any accidents or injuries stemming from the issue, indicating that the potential consequence of a crash due to the software failure did not actually occur. [80646]
Domain transportation The software failure incident reported in Article 80646 is related to the transportation industry. The article specifically mentions that Ford Motor Company issued a recall for the 2019 Lincoln Nautilus SUV due to a problem with the software related to the vehicle's advanced driver assist systems, which could lead to an increased risk of a crash if the driver does not receive warnings to return their hands to the wheel while the lane-centering system is activated [80646]. This incident falls under the transportation industry category as it involves a vehicle safety system designed to assist drivers during transportation.

Sources

Back to List